Credit cards: the fraudsters’ faithful friend

Credit cards: the fraudsters’ faithful friend

By Ralf Ohlhausen, Payment Expert and Business Development Director, PPRO Group

Before the birth of the credit card and advent of online shopping, transaction fraud was rare. Fast forward to today and “plastic fraud” is rife and moreover expected by merchants, many of whom skip straight to damage limitation rather than trying to fight it. As the most popular payment method after cash, fraud figures involving credit cards have skyrocketed since the e-commerce boom of the 1990’s with fraud losses from UK-issued cards in 2014 alone, amounting to £479 million.

“Card-not-present” transactions have made it all too easy for fraudsters to bypass crucial, physical control mechanisms including a signature, photo comparisons, or chip-and-PIN processes which simply cannot be carried out online.

Attempts to limit the losses
To limit rising figures, the credit card industry has made various attempts over the past 20 years to stop the fraudsters in their tracks, with varying degrees of success.

With the introduction of PCI DSS (payment card industry data security standard), merchants were required to implement security measures to secure credit card details that they had stored or collected. A 12-point list details the security requirements for merchants’ IT environments and those of Payment Service Providers and companies that don’t adhere to the requirements, are not permitted to perform credit card transactions. The introduction of the standard has affected mostly smaller merchants, whose lack of PCI certification means that their credit card transactions need to be performed by PSPs or other financial institutions who have the high security standards required. Unfortunately, the introduction of (and adherence to) PCI-DSS has not prevented the details of millions of cards from being stolen over the past few years, particularly from major merchants – ironically.

Other approaches to secure online credit card use have involved the card holder needing to provide the expiry date and address details to verify their identity. The latter can, however, only be verified in a few countries and even then, often not completely. In 3-D Secure, the industry thought it had scored its greatest hit. During this payment process, cardholders were redirected to the banks which issued their credit cards and asked to enter a secret code in a pop-up window. This requirement, however, led to customers terminating orders during the final step, either because they had forgotten their code or because they hadn’t registered with 3-D Secure in the first place. Although this option put the liability onto the bank and cardholder rather than the merchant for any fraudulent transactions, it was deemed a conversion killer and as well as reducing fraud it also reduced transactions.

As an alternative method of verification, most sites merely ask their customers to enter the security code (CVC, or Card Validation Code) printed on the back of their card when processing a transaction. As these codes may not be stored by the merchant or by any other partner involved in the transaction, this method provides a certain measure of security for the cardholder but is however useless if the card is stolen or photocopied.

The most recent approach to securing online credit card transactions is known as “tokenisation”. In order to carry out this process, credit card companies store a numerical “token” for each credit card in a database. This is then shared with the merchant during the online payment process, rather than sharing the credit card details themselves. The payment is authorised by automatically comparing the token with the credit card company’s database. The original idea was to assign a new token for each transaction, but for those merchants offering the popular one-click payment option, static tokens are needed which can be stored and re-used for each payment, which increases the risk once again.

No one-fix solution
The bottom line is that despite numerous efforts to make the credit card a secure method for online payment, they have not had a lasting effect due to a number of reasons, with fraud figures showing no signs of stabilising or decreasing in the short-term.

Criminals will always find loopholes and the processes designed to increase online security are often dismissed by merchants or poorly implemented, due to concerns around the affect upon order conversion rates. When it comes to card payments, there is, unfortunately, no one solution to this dilemma, as payments initiated by merchants which require data to be transmitted or stored in some form will always leave a back door open for data thieves.

The challenge for merchants is to incorporate alternative payment options to help them spread the risk and offer shoppers a more secure method for payment alongside the trusted and much loved credit card, whilst safeguarding their own finances.

[su_button url=”https://www.ppro.com/” target=”blank” style=”flat” background=”#df2027″ color=”#ffffff” size=”10″ radius=”0″ icon=”icon: arrow-circle-right”]For more information on PPRO Group click here[/su_button]

About Security Buyer

Security Buyer is the leading authority in global security content, delivering expert news, in-depth articles, exclusive interviews, and industry insights across print, digital, and event platforms. Published 10 times a year, the magazine is a trusted resource for professionals seeking updates and analysis on the latest developments in the security sector.

To submit an article, or for sponsorship opportunities, please contact our team below.

Rebecca Spayne picture 2025

Rebecca Spayne

Managing
EDITOR

Georgina Turner image

Georgina Turner

Sales
Manager

Afua Akoto image - Security Buyer

Afua Akoto

Marketing Manager

Read the Latest Issue

Follow us on X

Follow us on X

Click Here

Follow us on LinkedIn

Follow us on LinkedIn

Click Here

Advertise here

Reach decision makers and amplify your marketing

Advertise here

Click Here

Related News

digital

It’s time for banks to secure digital identity

A new report published today by Mobey Forum’s Digital Identity Expert Group has identified unique opportunities for banks
fraud

Fraud Day – Saudi Arabia

Group-IB teamed up in late October with its partner Versos to host the first ever Fraud Day — Saudi Arabia in Riyadh, an innovative event
Callsign

Callsign’s Dynamic Interventions to tackle fraud

Callsign, the digital trust pioneer, has announced its Dynamic Interventions capability controlled by its Orchestration Engine. This technology allows…
Irisity

Ping Payments selects Sentinels

Ping Payments, the Nordics premier payments services provider for modern e-commerce and online transactions, has chosen Sentinels,
Hikvision

Hikvision commended at Retail Risk Fraud Awards 2021

Hikvision UK & Ireland has been highly commended in two major categories at the 2021 Retail Risk Fraud Awards: for the Retail Risk Vendor of the Year award
BLACK FRIDAY

Brits brace for £2.6 billion in Black Friday fraud

Ping Identity, the intelligent identity solution for the enterprise, has issued a stark warning to British shoppers ahead of the Black Friday
Arkose

Arkose Labs: Human-Originated cyber attacks on the rise

New data from Arkose Labs, a fraud deterrence platform, has revealed that Europe is seeing a noticeable spike in human attacks as the impact
Ping

Ping Identity adds new online Fraud detection

Ping Identity, the intelligent identity solution for the enterprise, continues to enhance its PingOne Cloud Platform with new online fraud
Scroll to Top